feat: add Create Spec button and fix Windows asyncio subprocess

[mmereu]

Summary

• Add "Create Spec with AI" button in empty kanban when project has no spec
• Fix Windows asyncio subprocess NotImplementedError
• Enable full tool access in spec chat (skills, subagents, WebSearch)

Changes

UI:

• New button in Pending column when has_spec=false and no features
• Opens SpecCreationChat for guided spec creation

Windows Fixes:

• Set WindowsProactorEventLoopPolicy in server/__init__.py
• Remove --reload from uvicorn (breaks Windows subprocess)
• Add process cleanup on startup in start_ui.bat

Spec Chat:

• Remove allowed_tools restriction for full tool access
• Add "user" to setting_sources for global skills
• Add WebFetch/WebSearch auto-approve hook

Test plan

• Create project without spec
• Verify "Create Spec with AI" button appears in empty kanban
• Click button opens SpecCreationChat
• Verify Claude can use WebSearch and skills

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Spec creation chat integrated into the Kanban board with overlay, create-spec action, and UI flow for creating specs.

• Improvements

  • Web-related tools now auto-approve to streamline web fetch/search usage.
  • Better Windows support for subprocesses and asyncio; startup now cleans prior port 8888 usage and production server messages note hot-reload behavior.

• UX

  • Assistant UI is hidden while spec creation overlay is open.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request introduces automatic approval for web tools (WebFetch/WebSearch) via a new security hook, fixes Windows asyncio subprocess support across multiple entry points, broadens chat session tool/skill scope and permission handling, and adds a Spec Creation UI flow with integrated chat components and conditional Kanban rendering.

Changes

Cohort / File(s)	Summary
Web Tools Auto-Approval client.py, security.py	Adds web_tools_auto_approve_hook and registers it via a PreToolUse matcher for WebFetch and WebSearch. Switches default permission handling from acceptEdits to bypassPermissions in client configuration, effectively auto-approving those web tools.
Windows Asyncio Event Loop Configuration server/__init__.py, server/main.py, start_ui.py, start_ui.bat	Sets asyncio.WindowsProactorEventLoopPolicy() on Windows at startup/import to fix subprocess behavior, propagates env to production subprocess invocation, updates startup messaging, and adds a pre-emptive port 8888 cleanup in the batch script.
Chat Session Permission & Scope Expansion server/services/spec_chat_session.py	Updates SpecChatSession.start() to include "user" in setting_sources and change permission_mode to bypassPermissions, expanding accessible skills/tools during spec creation.
Spec Creation UI Integration ui/src/App.tsx, ui/src/components/KanbanBoard.tsx, ui/src/components/KanbanColumn.tsx, ui/src/components/SpecCreationChat.tsx	Introduces SpecCreationChat overlay; adds showSpecChat state in App.tsx; extends KanbanBoard and KanbanColumn props with onCreateSpec, hasSpec, and showCreateSpec to conditionally surface a "Create Spec" action and wire creation callbacks to data refresh and UI visibility.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant PreToolUseMatcher as Matcher
    participant SecurityHook as web_tools_auto_approve_hook
    participant ToolExecutor as Tool (WebFetch/WebSearch)
    Client->>Matcher: Request to use tool (tool_name)
    Matcher->>SecurityHook: match for WebFetch/WebSearch
    SecurityHook-->>Matcher: return {} (auto-approve)
    Matcher->>ToolExecutor: invoke tool with approved permissions
    ToolExecutor-->>Client: tool result

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰✨ I hopped through hooks and danced on loops,
I nudged the web tools past permission hoops,
Windows got a proactor—subprocesses cheer,
A spec chat sprouts where none appeared near,
CodeRabbit bounds on, delighted and sincere. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 70.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both main changes: adding a Create Spec button UI feature and fixing Windows asyncio subprocess issues.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@start_ui.bat`:
- Around line 12-16: The script indiscriminately force-kills any PID listening
on port 8888 using the for loop and taskkill, which can terminate unrelated
services; update the block around the for /f (...) loop and taskkill usage to
(1) resolve the PID(s) for port 8888, (2) for each PID call tasklist /FI "PID eq
<pid>" or equivalent to retrieve the Image Name, (3) prompt the user with the
PID and process name and require confirmation before calling taskkill, and/or
add an explicit whitelist of expected process names to auto-kill; ensure the
flow handles multiple PIDs and aborts safely if the user declines or no
whitelist match is found.

In `@start_ui.py`:
- Around line 189-207: The docstring and printed message in
start_production_server are misleading because the code launches uvicorn without
--reload (so there is no hot reload) and the comment about PYTHONASYNCIODEBUG
doesn't match since the env copy never sets that variable; update the
start_production_server function to (1) change the docstring and the print() to
state that the server is started in production mode without hot reload, and (2)
either remove/adjust the PYTHONASYNCIODEBUG comment or actually set
env["PYTHONASYNCIODEBUG"] = "1" before passing env into subprocess.Popen
(referencing start_production_server, venv_python, env, and the subprocess.Popen
call to locate the code).

🧹 Nitpick comments (3)

ui/src/components/KanbanColumn.tsx (1)

88-97: Add explicit button type for safety.

Optional, but avoids accidental form submission if this component ever renders inside a <form>.

♻️ Proposed tweak

-                <button
+                <button
+                  type="button"
                   onClick={onCreateSpec}
                   className="neo-btn neo-btn-primary inline-flex items-center gap-2"
                 >

ui/src/App.tsx (1)

452-466: Add modal accessibility attributes to the overlay container.

This improves screen-reader handling for the full-screen modal.

♿ Proposed accessibility tweak

-      {showSpecChat && selectedProject && (
-        <div className="fixed inset-0 z-50 bg-[var(--color-neo-bg)]">
+      {showSpecChat && selectedProject && (
+        <div
+          className="fixed inset-0 z-50 bg-[var(--color-neo-bg)]"
+          role="dialog"
+          aria-modal="true"
+          aria-label="Spec creation"
+        >

server/services/spec_chat_session.py (1)

182-185: Clarify the security and architectural intent for unrestricted tool access in spec_chat_session.

The code intentionally enables full tool access via setting_sources=["project", "user"] and permission_mode="bypassPermissions" with no allowed_tools constraint, as documented in the code comment. However, there is no documented rationale for why spec generation requires broader access than the read-only assistant service (which explicitly restricts tools). Consider adding a comment explaining the business requirement for unrestricted access, or implement environment-based gating (as suggested in the original diff) if this scope should be toggleable.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Avoid killing unrelated processes on port 8888.
The current block force-kills any listener on 8888, which can terminate unrelated services. Consider prompting the user (or filtering to expected process names) before killing.

🐛 Proposed safer prompt before killing

-REM Kill any existing processes on port 8888
-echo Cleaning up old processes...
-for /f "tokens=5" %%a in ('netstat -aon ^| findstr ":8888" ^| findstr "LISTENING"') do (
-    taskkill /F /PID %%a >nul 2>&1
-)
+REM Kill any existing processes on port 8888 (with confirmation)
+echo Checking for processes on port 8888...
+for /f "tokens=5" %%a in ('netstat -aon ^| findstr ":8888" ^| findstr "LISTENING"') do (
+    echo Found PID %%a listening on 8888.
+    choice /M "Terminate PID %%a?"
+    if errorlevel 2 (
+        echo Skipping PID %%a
+    ) else (
+        taskkill /F /PID %%a >nul 2>&1
+    )
+)

🤖 Prompt for AI Agents

In `@start_ui.bat` around lines 12 - 16, The script indiscriminately force-kills
any PID listening on port 8888 using the for loop and taskkill, which can
terminate unrelated services; update the block around the for /f (...) loop and
taskkill usage to (1) resolve the PID(s) for port 8888, (2) for each PID call
tasklist /FI "PID eq <pid>" or equivalent to retrieve the Image Name, (3) prompt
the user with the PID and process name and require confirmation before calling
taskkill, and/or add an explicit whitelist of expected process names to
auto-kill; ensure the flow handles multiple PIDs and aborts safely if the user
declines or no whitelist match is found.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Fix misleading hot‑reload messaging and env comment.

--reload is explicitly not used, so “with hot reload” in the docstring/log is inaccurate, and the PYTHONASYNCIODEBUG comment doesn’t match the code.

📝 Suggested cleanup

-def start_production_server(port: int):
-    """Start FastAPI server in production mode with hot reload."""
+def start_production_server(port: int):
+    """Start FastAPI server in production mode."""
@@
-    print(f"\n  Starting server at http://127.0.0.1:{port} (with hot reload)")
+    print(f"\n  Starting server at http://127.0.0.1:{port}")
@@
-    # Set PYTHONASYNCIODEBUG to help with Windows subprocess issues
     env = os.environ.copy()
+    # Optional: enable asyncio debug when troubleshooting Windows subprocess issues
+    # env["PYTHONASYNCIODEBUG"] = "1"

🤖 Prompt for AI Agents

In `@start_ui.py` around lines 189 - 207, The docstring and printed message in
start_production_server are misleading because the code launches uvicorn without
--reload (so there is no hot reload) and the comment about PYTHONASYNCIODEBUG
doesn't match since the env copy never sets that variable; update the
start_production_server function to (1) change the docstring and the print() to
state that the server is started in production mode without hot reload, and (2)
either remove/adjust the PYTHONASYNCIODEBUG comment or actually set
env["PYTHONASYNCIODEBUG"] = "1" before passing env into subprocess.Popen
(referencing start_production_server, venv_python, env, and the subprocess.Popen
call to locate the code).

[leonvanzyl]

Thank you!